RHSA-2026:54577CriticalCVSS 9.9

Red Hat Security Advisory: Multicluster Global Hub 1.5.7 security update

Published
August 13, 2026
Last Modified
August 20, 2026

🔗 CVE IDs covered (3)

CVE-2026-66801 · pendingCVE-2026-42306 →CVE-2026-55969 →

📋 Description

CVE-2026-42306 — github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup CVE-2026-55969 — thrift: github.com/apache/thrift: Apache Thrift: Denial of Service via integer overflow or wraparound CVE-2026-66801 — multicluster-global-hub: multicluster-global-hub: shared Kafka gh-spec topic Write ACL plus spoofable CloudEvent source enables fleet-wide cluster-admin from any compromised managed hub

🎯 Affected products22

  • Red Hat multicluster global hub 1.5.1
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6065e223ba12401f3bd6058f921dd3535e05e331c3ae1dd32452c1bc91d6cc76_ppc64le as a component of Red Hat multicluster global hub 1.5.1
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:8716b6b65ed359d7bf25e08bc66190f8910d23513af3020fb5c5b01ce0dcfefc_arm64 as a component of Red Hat multicluster global hub 1.5.1
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:9d972f0ad2e861d55e197d70fcbb20b9f888c25db48de5ea908b2361f6ad1001_amd64 as a component of Red Hat multicluster global hub 1.5.1
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:b453630e58fe386ccf0f1f0323429e5ca93600ad54818ef6ebe2a1437cc1fb97_s390x as a component of Red Hat multicluster global hub 1.5.1
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:b2f257311eb12181da5e961ac182561338b4e0afb66bfc0e1348af98814f443a_ppc64le as a component of Red Hat multicluster global hub 1.5.1
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:bfca5230561f1901c2208ee6242831ea0b8f185c51166c8a2cfa9ac749be38bc_amd64 as a component of Red Hat multicluster global hub 1.5.1
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:cd6c5ce0a19e15ce0091d4a342599c85998453b9cb495584cce4c16ae99e25d2_arm64 as a component of Red Hat multicluster global hub 1.5.1
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:d379244d0bab3d63bd6790b3a8a0cb1a4ce2aad42494ee8fd9a1990f283d01c3_s390x as a component of Red Hat multicluster global hub 1.5.1
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:6e6a1da8ae29ab7b2d58748d7e45941989b9c3091434a5d13731ac7d453377e6_ppc64le as a component of Red Hat multicluster global hub 1.5.1
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7fe412718d7bd3e37855a085a53394d93064741830df7e922a2164d8fcacb92a_amd64 as a component of Red Hat multicluster global hub 1.5.1
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:b497a86bb02a05f3758c6b5722fb0da61ca5f448092d322359dd4d06cdd08870_arm64 as a component of Red Hat multicluster global hub 1.5.1
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ed25546c40b9e986a77981c9a4c9c43f929304dc0c25a507b5d041d8af4894a5_s390x as a component of Red Hat multicluster global hub 1.5.1
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:14205b6421ccc45ed5935e0d1e8741812f108c380440da3623064f22567ea040_amd64 as a component of Red Hat multicluster global hub 1.5.1
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1843b2f6e362127e0fe74fb6cf4f96828fcf7d82753370c17a23075ce7538ff9_arm64 as a component of Red Hat multicluster global hub 1.5.1
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:5d4aefd119a1eecffdefec66ffc4d91462978a478a730e97f025069d4ab90f21_amd64 as a component of Red Hat multicluster global hub 1.5.1
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c7f3aa6419753ff217d2d05a659a1951e0ad840b3c3f1d04780f489c93421c25_ppc64le as a component of Red Hat multicluster global hub 1.5.1
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d7557d40a63a755904852baa59c6106cbe16ce0e8cbc1ce5986fc50152094315_s390x as a component of Red Hat multicluster global hub 1.5.1
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:54fa72b965dba7dad60263362a95515ca41ca5c5d62621690c025a99a7977a77_s390x as a component of Red Hat multicluster global hub 1.5.1
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:b780e75db2833550d5618c44d63cc374a4a38c8d327e514ef2aa2c8ce8badb95_amd64 as a component of Red Hat multicluster global hub 1.5.1
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d4fe193c51324c2cfa286f61c5e0cc10bf4e848c874967af10161a6b8e5bd321_arm64 as a component of Red Hat multicluster global hub 1.5.1
  • registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:ffa96130ce94a9d9f51cabce8e2e6eac64f01034b596cc7d2b90d33713496ccf_ppc64le as a component of Red Hat multicluster global hub 1.5.1

✅ Remediation

For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation: https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.14/html/multicluster_global_hub/index Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (6)